feat: fb and google oauth

internal/model/user.go

@@ -5,7 +5,9 @@ import "time"
 // User represents a row in the `users` table.
 //
 // PasswordHash is tagged `json:"-"` so it never leaks via JSON marshalling
-// even if a caller accidentally passes a User through response.JSON.
+// even if a caller accidentally passes a User through response.JSON. It's a
+// pointer because OAuth-only users have no password — *PasswordHash == nil
+// means "this account can only sign in via a linked OAuth provider".
 //
 // EmailVerifiedAt is a pointer so JSON-encoded users carry an explicit `null`
 // when the user has not yet verified, instead of an omitted field — the
@@ -19,7 +21,7 @@ type User struct {
 	Role            string     `json:"role"`
 	Plan            string     `json:"plan"` // "free" | "premium"
 	EmailVerifiedAt *time.Time `json:"email_verified_at"`
-	PasswordHash    string     `json:"-"`
+	PasswordHash    *string    `json:"-"`
 	TokenVersion    int        `json:"-"`
 	CreatedAt       time.Time  `json:"created_at"`
 	UpdatedAt       time.Time  `json:"updated_at"`
@@ -42,6 +44,21 @@ const (
 	PurposeEmailVerification = "email_verification"
 )
 
+// OAuthAccount represents a row in the `oauth_accounts` table — one entry
+// per (provider, provider_user_id). A single user can have several linked
+// providers.
+type OAuthAccount struct {
+	ID             string    `json:"id"`
+	UserID         string    `json:"user_id"`
+	Provider       string    `json:"provider"`
+	ProviderUserID string    `json:"provider_user_id"`
+	Email          *string   `json:"email"`
+	Name           *string   `json:"name"`
+	AvatarURL      *string   `json:"avatar_url"`
+	CreatedAt      time.Time `json:"created_at"`
+	UpdatedAt      time.Time `json:"updated_at"`
+}
+
 // ShortURL represents a shortened URL.
 type ShortURL struct {
 	ID         string     `json:"id"`